Understanding Threat Modelling

Threat modelling is a proactive cybersecurity process that helps organizations identify, assess, and mitigate potential security risks. By systematically analyzing vulnerabilities and attack vectors, teams can prioritize security controls and reduce overall risk exposure before threats materialize.

---

Why Threat Modelling Matters

Effective threat modelling enables organizations to:

• Proactively address security gaps before they are exploited
• Allocate resources efficiently by focusing on high-impact risks
• Align security with business objectives through structured risk assessment
• Improve compliance with industry standards (e.g., ISO 27001, NIST)

---

Core Concepts

Threat

A potential event, actor, or circumstance that could exploit vulnerabilities to compromise confidentiality, integrity, or availability of systems/data.

Examples:

• Cyber attacks (e.g., ransomware, phishing)
• Human error (e.g., misconfigured cloud storage)
• Environmental factors (e.g., power outages, natural disasters)

Vulnerability

A weakness in systems, applications, or processes that threats can exploit.

Common sources:

• Software bugs (e.g., unpatched CVEs)
• Design flaws (e.g., lack of input validation)
• Operational gaps (e.g., weak password policies)

Risk

The potential impact of a threat exploiting a vulnerability, measured by:

• Likelihood: Probability of occurrence
• Impact: Severity of consequences (financial, reputational, operational)

Risk formula: Risk = Likelihood × Impact

---

Threat Modelling Process

1. Define Scope

Establish boundaries for the analysis:

• System components: Hardware, software, networks
• Data flows: How information moves through the system
• Trust boundaries: Where access controls change (e.g., API gateways)

2. Identify Assets

List critical assets requiring protection:

Asset Type	Examples
Data	Customer PII, intellectual property
Systems	Databases, authentication servers
Processes	Payment processing, user onboarding

3. Threat Identification

Use frameworks to systematically uncover threats:

• STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege)
• OWASP Top 10 for web application risks

4. Vulnerability Analysis

Map vulnerabilities to threats using:

• CVSS scoring (Common Vulnerability Scoring System)
• Attack surface analysis (e.g., exposed APIs, default credentials)

5. Risk Prioritization

Evaluate risks using a matrix:

Likelihood \ Impact	Low	Medium	High
High	Monitor	Mitigate	Urgent
Medium	Accept	Mitigate	Mitigate
Low	Accept	Accept	Monitor

6. Countermeasure Development

Implement controls based on the NIST Cybersecurity Framework:

• Identify: Asset inventory, risk assessments
• Protect: Encryption, access controls
• Detect: SIEM tools, anomaly detection
• Respond: Incident response plans
• Recover: Backup strategies, post-mortems

7. Continuous Monitoring

• Automated tools: Vulnerability scanners (e.g., Nessus, OpenVAS)
• Manual reviews: Red team exercises, penetration testing
• Metrics: Track mean time to detect (MTTD) and remediate (MTTR)

---

Advanced Techniques

Attack Trees

Visualize attack paths hierarchically:

Root Goal: Steal Customer Data
├── Path 1: Exploit Web App
│   ├── SQL Injection
│   └── XSS
└── Path 2: Social Engineering
    ├── Phishing
    └── Pretexting

Threat Modelling Tools

Tool/Framework	Use Case	Key Features
STRIDE	Microsoft-developed methodology	Covers 6 threat categories
PASTA	Risk-centric approach	Aligns with business objectives
VAST	Scalable for large enterprises	Automated threat modeling
OWASP Threat Dragon	Open-source diagramming	Integrates with CI/CD pipelines

---

Practical Example: E-Commerce Platform

Scenario: Protecting payment data in an online store.

1. Scope: Checkout process, payment gateway, user accounts
2. Assets: Credit card data, user credentials, transaction logs
3. Threats:
   • Payment skimming (e.g., Magecart attacks)
   • Credential stuffing
4. Vulnerabilities:
   • Lack of PCI DSS compliance
   • Weak session management
5. Countermeasures:
   • Tokenization of payment data
   • Multi-factor authentication (MFA)
   • Regular PCI DSS audits

---

Common Pitfalls to Avoid

• Over-scoping: Focus on critical assets first
• Static models: Update threat models with system changes
• Ignoring insider threats: Include human factors in analysis
• Tool dependency: Combine automated tools with expert review

---

Learn More

Further Reading

• Books:
  • Threat Modeling: Designing for Security by Adam Shostack
  • The Web Application Hacker’s Handbook by Dafydd Stuttard
• Standards:
  • NIST SP 800-30 (Risk Assessment)
  • ISO/IEC 27005 (Information Security Risk Management)

Hands-On Practice

• Labs: Try threat modeling on OWASP Juice Shop
• Certifications:
  • Certified Threat Modeling Professional (CTMP)
  • GIAC Security Expert (GSE)

Community Resources

• OWASP Threat Modeling Project: owasp.org/www-community/Threat_Modeling
• Threat Modeling Manifesto: threatmodelingmanifesto.org